Security
A rewritten EU cyber resiliency act removes the biggest threats to open source but much standards work still to be done, says Linux Foundation Europe
"We will act immediately to apply our current security standards to Microsoft-owned legacy systems and internal business processes..."
There are no workarounds that remove the vulnerability, which allows unauthenticated remote command execution on vulnerable systems. A patch is available.
MI5 is off to the cloud; GCHQ is ramping up Computer Network Exploitation capabilities; MI6 needs cultural changes to get a new IT platform running smoothly...
The 2023 season was “the first season we travelled with our whole IT equipment without any server rack..."
"Enterprises are deploying a mix of technologies for secure remote access, including VPN, ZTNA, SD-WAN and SASE – on average respondents are using 2.3 different solutions, but..."
VPN appliances "all appear to have been constructed with the code equivalent of string, stamped with the word ‘secure’ and then just left to decay for 20 years..."
"In every insider threat case, there is a combination of network activity and employee behaviour. The malicious activity crosses both physical and electronic modalities..."
Attackers re-write JavaScript loaded by the VPN login page for the Appliance to capture credentials; also grabbed Veeam credentials, moved laterally for full SYSTEM control.